diff --git a/main/document/edit_document.php b/main/document/edit_document.php
index b223954ddd..c946b0d67b 100644
--- a/main/document/edit_document.php
+++ b/main/document/edit_document.php
@@ -1,9 +1,9 @@
-<?php // $Id: edit_document.php 14776 2008-04-08 06:55:16Z elixir_inter $
+<?php // $Id: edit_document.php 14904 2008-04-15 17:22:45Z juliomontoya $
 /*
 ==============================================================================
 	Dokeos - elearning and course management software
 
-	Copyright (c) 2004 Dokeos S.A.
+	Copyright (c) 2004-2008 Dokeos S.A.
 	Copyright (c) 2003 Ghent University (UGent)
 	Copyright (c) 2001 Universite catholique de Louvain (UCL)
 	Copyright (c) Olivier Brouckaert
@@ -21,7 +21,8 @@
 
 	See the GNU General Public License for more details.
 
-	Contact: Dokeos, 181 rue Royale, B-1000 Brussels, Belgium, info@dokeos.com
+	Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium, info@dokeos.com
+	
 ==============================================================================
 */
 /**
@@ -252,9 +253,9 @@ if (isset($_POST['newComment']))
 	$newTitle = trim($_POST['newTitle']); // remove spaces
 	// Check if there is already a record for this file in the DB
 
-	$result = mysql_query ("SELECT * FROM $dbTable WHERE path LIKE BINARY '".$commentPath."'");
+	$result = api_sql_query ("SELECT * FROM $dbTable WHERE path LIKE BINARY '".$commentPath."'");
 
-	while($row = mysql_fetch_array($result, MYSQL_ASSOC))
+	while($row = Database::fetch_array($result, MYSQL_ASSOC))
 	{
 		$attribute['path'      ] = $row['path'      ];
 		$attribute['comment'   ] = $row['title'   ];
@@ -264,7 +265,7 @@ if (isset($_POST['newComment']))
 
 	//new code always keeps document in database
 	$query = "UPDATE $dbTable SET comment='".$newComment."', title='".$newTitle."' WHERE path LIKE BINARY '".$commentPath."'";
-	mysql_query($query);
+	api_sql_query($query);
 	//this is an UPDATE page... we shouldn't be creating new documents here.
 	/*
 	if (mysql_affected_rows() == 0)
@@ -303,14 +304,14 @@ if (isset($_POST['renameTo']))
 
 /** TODO check if this code is still used **/
 /* Search the old comment */  // RH: metadata: added 'id,'
-$result = mysql_query ("SELECT id,comment,title FROM $dbTable WHERE path LIKE BINARY '$dir$doc'");
+$result = api_sql_query("SELECT id,comment,title FROM $dbTable WHERE path LIKE BINARY '$dir$doc'");
 
 $message = "<i>Debug info</i><br>directory = $dir<br>";
 $message .= "document = $file_name<br>";
 $message .= "comments file = " . $file . "<br>";
 //Display::display_normal_message($message);
 
-while($row = mysql_fetch_array($result, MYSQL_ASSOC))
+while($row = Database::fetch_array($result, MYSQL_ASSOC))
 {
 	$oldComment = $row['comment'];
 	$oldTitle = $row['title'];
@@ -509,18 +510,35 @@ else
 	$form->addElement('hidden','renameTo');
 }
 
+if($extension == "htm" || $extension == "html")
+{
+	$form->addElement('hidden','formSent');
+	$defaults['formSent'] = 1;
+	$form->addElement('submit','submit',get_lang('Ok'));
+	$form->add_html_editor('texte','<a style="cursor:pointer" onclick="launch_templates()"><img src="'.api_get_path(WEB_IMG_PATH).'templates.gif" /></a>',false,true);
+	$defaults['texte'] = $texte;
+}
+if(!$group_document)
+{
+	$metadata_link = '<a href="../metadata/index.php?eid='.urlencode('Document.'.$docId).'">'.get_lang('AddMetadata').'</a>';
+	$form->addElement('static',null,get_lang('Metadata'),$metadata_link);
+}
+
+$form->addElement('textarea','newComment',get_lang('Comment'),'rows="3" style="width:300px;"');
+
 // readonly
 $sql = 'SELECT id, readonly FROM '.$dbTable.'
 		WHERE path LIKE BINARY "'.$dir.$doc.'"';
 $rs = api_sql_query($sql, __FILE__, __LINE__);
-$readonly = mysql_result($rs,0,'readonly');
-$doc_id = mysql_result($rs,0,'id');
+$readonly = Database::result($rs,0,'readonly');
+$doc_id = Database::result($rs,0,'id');
 // owner
 $sql = 'SELECT insert_user_id FROM '.Database::get_course_table(TABLE_ITEM_PROPERTY).'
 		WHERE tool LIKE "document"
 		AND ref='.intval($doc_id);
 $rs = api_sql_query($sql, __FILE__, __LINE__);
-$owner_id = mysql_result($rs,0,'insert_user_id');
+$owner_id = Database::result($rs,0,'insert_user_id');
+
 if($owner_id != $_user['user_id'])
 {
 	$form->addElement('hidden','readonly');
@@ -533,20 +551,10 @@ else
 }
 $defaults['readonly']=$readonly;
 
-if($extension == "htm" || $extension == "html")
-{
-	$form->addElement('hidden','formSent');
-	$defaults['formSent'] = 1;
-	$form->addElement('submit','submit',get_lang('Ok'));
-	$form->add_html_editor('texte','<a style="cursor:pointer" onclick="launch_templates()"><img src="'.api_get_path(WEB_IMG_PATH).'templates.gif" /></a>',false,true);
-	$defaults['texte'] = $texte;
-}
-if(!$group_document)
-{
-	$metadata_link = '<a href="../metadata/index.php?eid='.urlencode('Document.'.$docId).'">'.get_lang('AddMetadata').'</a>';
-	$form->addElement('static',null,get_lang('Metadata'),$metadata_link);
-}
-$form->addElement('textarea','newComment',get_lang('Comment'),'rows="3" style="width:300px;"');
+
+
+
+
 $form->addElement('submit','submit',get_lang('Ok'));
 $defaults['filename'] = $filename;
 $defaults['extension'] = $extension;
diff --git a/main/document/headerpage.php b/main/document/headerpage.php
index f637e314df..a1613aedae 100644
--- a/main/document/headerpage.php
+++ b/main/document/headerpage.php
@@ -9,16 +9,14 @@ $language_file = 'document';
 
 
 	include('../inc/global.inc.php');
-
 	$noPHP_SELF=true;
+	$header_file= Security::remove_XSS($_GET['file']);	
+	$path_array=explode('/',str_replace('\\','/',$header_file));
+	$path_array = array_map('urldecode',$path_array);
+	
+	$header_file=implode('/',$path_array);
 
-	$path_array=explode('/',str_replace('\\','/',$_GET['file']));
-
-	$path_array = array_map('urlencode',$path_array);
-
-	$_GET['file']=implode('/',$path_array);
-
-	$nameTools = $_GET['file'];
+	$nameTools = $header_file;
 
 	if(isset($_SESSION['_gid']) && $_SESSION['_gid']!='')
 	{
@@ -26,12 +24,12 @@ $language_file = 'document';
 		$interbreadcrumb[]= array ("url"=>"../group/group_space.php?gidReq=".$_SESSION['_gid'], "name"=> get_lang('GroupSpace'));
 	}
 
-	$interbreadcrumb[]= array ("url"=>"./document.php?curdirpath=".dirname($_GET['file']).$req_gid, "name"=> $langDocuments);
-	$interbreadcrumb[]= array ("url"=>"showinframes.php?file=".$_GET['file'], "name"=> $_GET['file']);
+	$interbreadcrumb[]= array ("url"=>"./document.php?curdirpath=".dirname($header_file).$req_gid, "name"=> $langDocuments);
+	$interbreadcrumb[]= array ("url"=>"showinframes.php?file=".$header_file, "name"=>$header_file);
 	
 	Display::display_header(null,"Doc");
 
 	echo "<div align=\"center\">";
-	echo "<a href='".api_get_path('WEB_COURSE_PATH').$_course['path'].'/document'.$_GET['file']."?".api_get_cidreq()."' target='blank'>".$lang_cut_paste_link."</a></div>";
+	echo "<a href='".api_get_path('WEB_COURSE_PATH').$_course['path'].'/document'.$header_file."?".api_get_cidreq()."' target='blank'>".$lang_cut_paste_link."</a></div>";
 
 ?>
\ No newline at end of file
diff --git a/main/document/showinframes.php b/main/document/showinframes.php
index 0491b9357b..c91e8140f9 100644
--- a/main/document/showinframes.php
+++ b/main/document/showinframes.php
@@ -1,4 +1,4 @@
-<?php // $Id: showinframes.php 14729 2008-04-02 23:44:29Z yannoo $ 
+<?php // $Id: showinframes.php 14904 2008-04-15 17:22:45Z juliomontoya $ 
 /*
 ============================================================================== 
 	Dokeos - elearning and course management software
@@ -52,15 +52,25 @@
 	   DOKEOS INIT 
 ============================================================================== 
 */ 
-
+$language_file[] = 'document';
 include('../inc/global.inc.php');
 
+if (!empty($_GET['nopages']))
+{
+	$nopages=Security::remove_XSS($_GET['nopages']);
+	if ($nopages==1)
+	{		
+		require_once(api_get_path(INCLUDE_PATH) . 'reduced_header.inc.php');
+		Display::display_error_message(get_lang('FileNotFound'));
+	}
+	exit();	
+}
+
 $_SESSION['whereami'] = 'document/view';
 	
-$interbreadcrumb[]= array ("url"=>"./document.php", "name"=> get_lang("Documents"));
-$nameTools = get_lang("Documents");
-
-$file = $_GET['file'];
+$interbreadcrumb[]= array ('url'=>'./document.php', 'name'=> get_lang('Documents'));
+$nameTools = get_lang('Documents');
+$file = Security::remove_XSS(urldecode($_GET['file']));
 
 /*
 ============================================================================== 
@@ -74,14 +84,18 @@ header('Last-Modified: Wed, 01 Jan 2100 00:00:00 GMT');
 header('Cache-Control: no-cache, must-revalidate');
 header('Pragma: no-cache');
 
-$browser_display_title = "Dokeos Documents - " . $_GET['cidReq'] . " - " . $_GET['file'];
+$browser_display_title = "Dokeos Documents - " . $_GET['cidReq'] . " - " . $file;
 
 //only admins get to see the "no frames" link in pageheader.php, so students get a header that's not so high
 $frameheight = 130;
 if($is_courseAdmin)
 {
-	$frameheight = 150;
+	$frameheight = 150;	
 }
+$file_root=$_course['path'].'/document'.str_replace('%2F', '/',$file);
+$file_url_sys=api_get_path('SYS_COURSE_PATH').$file_root;
+$file_url_web=api_get_path('WEB_COURSE_PATH').$file_root;
+
 
 ?>
 <html>
@@ -89,8 +103,17 @@ if($is_courseAdmin)
 <title><?php echo $browser_display_title;?></title>
 </head>
 	<frameset rows="<?php echo $frameheight; ?>,*" border="0" frameborder="no" >
-		<frame name="top" scrolling="no" noresize target="contents" src="headerpage.php?file=<?php echo urlencode($_GET['file']).'&amp;'.api_get_cidreq(); ?>">
-		<frame name="main" src="<?php echo api_get_path('WEB_COURSE_PATH').$_course['path'].'/document'.str_replace('%2F', '/',urlencode($_GET['file'])).'?'.api_get_cidreq().'&rand='.mt_rand(1,10000); ?>">
+		<frame name="top" scrolling="no" noresize target="contents" src="headerpage.php?file=<?php echo $file.'&amp;'.api_get_cidreq(); ?>">
+		<?php
+		if (file_exists($file_url_sys))
+		{								
+			echo '<frame name="main" src="'.$file_url_web.'?'.api_get_cidreq().'&rand='.mt_rand(1,10000).'">';		
+		}
+		else
+		{
+			echo '<frame name="main" src=showinframes.php?nopages=1>';				
+		}		
+		?>
 	<noframes>
 	<body>
 		<p>This page uses frames, but your browser doesn't support them.<br/>